NIST Cybersecurity Framework Overview
Key Points
- The U.S. NIST Cybersecurity Framework (CSF) provides a structured approach—Identify, Protect, Detect, Respond, Recover—with a new Governance layer added in version 2.0 to guide organizations in aligning security with business objectives.
- Governance requires understanding the organization’s mission, risk tolerance, role responsibilities, and developing policies and procedures, with risk assessment recommended as the starting point.
- The Identify function focuses on cataloguing assets—data, hardware, software, and identities—and employing tools for dynamic discovery and classification of sensitive information.
- Risk analysis within Identify includes assessing the attack surface and conducting vulnerability assessments to pinpoint where adversaries could gain access.
- Effective governance, asset identification, and attack‑surface management together form the foundation for building a comprehensive, risk‑driven cybersecurity program.
Sections
Full Transcript
# NIST Cybersecurity Framework Overview **Source:** [https://www.youtube.com/watch?v=Ula3TG8QS7g](https://www.youtube.com/watch?v=Ula3TG8QS7g) **Duration:** 00:08:28 ## Summary - The U.S. NIST Cybersecurity Framework (CSF) provides a structured approach—Identify, Protect, Detect, Respond, Recover—with a new Governance layer added in version 2.0 to guide organizations in aligning security with business objectives. - Governance requires understanding the organization’s mission, risk tolerance, role responsibilities, and developing policies and procedures, with risk assessment recommended as the starting point. - The Identify function focuses on cataloguing assets—data, hardware, software, and identities—and employing tools for dynamic discovery and classification of sensitive information. - Risk analysis within Identify includes assessing the attack surface and conducting vulnerability assessments to pinpoint where adversaries could gain access. - Effective governance, asset identification, and attack‑surface management together form the foundation for building a comprehensive, risk‑driven cybersecurity program. ## Sections - [00:00:00](https://www.youtube.com/watch?v=Ula3TG8QS7g&t=0s) **Untitled Section** - ## Full Transcript
here's an understatement for you cyber
security is really hard it feels like
there's millions of moving Parts how do
you know if you've got all the bases
covered well the good news is the US
National Institute of Standards also
known as nist created a cyber security
framework that will give you a general
idea of whether you've done all the
right things or not this is something
you can use to build your cyber security
program with and in the first version of
this it included categories like
identify protect detect respond and
recover and in the 2.0 version which is
about to come out they added another
layer the governance layer so let's take
a look so the cyber security framework
is really expansive I'm not going to
have time to cover the whole thing but
I'm going to hit just a few of the high
points to give you a general idea of
what it's about let's take a look at
this first one the governance layer that
was recently added in this one it says
we need to take a look at our
organizational context understand what
what's the mission of the the
organization what are the goals what is
it we're trying to achieve then we take
a look at risk this is a big one also
you need to understand what is the
organization's tolerance for risk or
their appetite for risk how much do you
want to take on how much are you going
to be risk averse because that's going
to affect a lot of other things um we
need to figure out who is responsible
for doing what there are various roles
that people will have in this
organization and then ultimately develop
policies and procedures that will
correspond to this a lot of
organizations start with developing
policies and I'm going to suggest they
should start with the risk because
understanding your risk will affect all
of these other things now we've set the
stage with the big picture of governance
now let's identify what it is that we
need to protect what are we going to
identify we're going to identify assets
that need to be protected what are the
assets that we're going to try to
protect well it's going to be things
like data it's going to be Hardware it's
going to be software it's going to be
people think about that in terms of
identities not the actual individuals
themselves that's a different subject
but these are the things we have to take
a look at so when I need a capability
that helps me identify what all of those
things are and tracks those assets uh in
some cases to do Dynamic discovery of
data and classifying it so that I know
where the sensitive stuff is then we
also need to identify what some of the
risks are we call that risk analysis and
in a risk analysis one of the things
we'll take a look at is the idea of
attack surface management and
vulnerability analysis these are a
couple of things that we have to do the
attack surface that's the whole area
where the bad guy could potentially get
to us we need to make sure that we know
what all of those open switches might be
so that we can close them and we need to
find out where the vulnerabilities exist
now how do we protect these things well
remember our old friend if you've seen
some of my other videos where I talk
about the CIA Triad that deals with
confidentiality integrity and
availability these are the Hallmarks of
what we're trying to do to protect
things in a cyber security environment I
want to make sure that sensitive stuff
is only available to the people that are
supposed to have it it's confidential
that it can't be tampered with it has
integrity and that it's available to the
people that need it so that's our goal
well what kind of things can we put in
place to do that well we're going to use
things like cryptography because in in
crypting information we make it so that
other people can't see it if they're
just happen to be on our Network then
they they won't be able to see the
sensitive information or if it's in a
database that is data at rest then it
will not be easily seen other things
we're going to add are identity and
access management capabilities like
multiactor authentication so that I
really know it's us when you go to log
into the system I'm going to use other
things like pass keys that make the
system even more secure than a password
would and then I'm going to also make
sure that I have a good backup recovery
system in particular on the protect side
we're going to talk about backup the
data at some point could be compromised
I need to make sure that I have a good
backup now the cyber security framework
says we need a category to deal with
detection of threats things where we
tried to protect but it might have
failed so I need a monitoring capability
and with that monitor I need to be able
to figure out if I have Adverse Events
so I need to be able to analyze those
things now what kind of tools would I
need in place to do that kind of stuff
well one thing that would help is an
endpoint detection and response
capability that goes on my individual
workstations and tells me if I've got
malware or other types of bad behaviors
uh a network detection response
capability that lets me know if
anomalies are happening at the network
layer a thread intelligence feed that
tells me what kinds of things are
happening in the wide environment uh
maybe even outside of our own network
what kinds of threat should we be
looking for and the attack surface
management capability that I mentioned
previously that's something that I'd
like to also take into account because
that's where the guys are trying to
attack well that's a whole bunch of
tools so what I really want is something
called a security information and event
management system that actually
coordinates and takes information to
limit from all of these different
systems correlates Aggregates and allows
me to do that level of
analysis we detected an adverse event
with our security information event
management system and now we need to go
further and figure out what we need to
do with this we open an incident we have
a system that has cases and we need a
management system that tracks those so
that I can assign a case to an
individual person I can gather all the
information that relates to that case
and pass it off to them the indicators
of compromise the things that I've
discovered while I was doing my own
analysis of this so I'm going to need to
analyze this particular case and then
ultimately I need a capability to do
mitigation so I want to be able to have
something that allows me to know what I
do once I have found that this is a
problem and I know it's a problem so we
have these things called Dynamic
playbooks that help us do that Dynamic
playbooks lead you through the steps
that you need to do to do resolution all
of these Technologies together we refer
to as security orchestration Automation
and response sore for short remember
that backup I told you to take over here
in the protect stage well we're going to
now need that because now I want to
restore if the outage I just had caused
me to lose data then I need to be able
to get that data back but just bringing
it back may not be enough I also need to
verify that the data is in fact secure
that it hasn't been changed that it
maintains Integrity for instance and
then depending on the type of outage it
might have been there may be some
Communications that have to happen I may
need to notify certain organizations
within my company I may also have to
notify if this was a data breach the
consumers who were affected by this so
look at what the Regulatory Compliance
aspects of all of these things are that
you're responsible for and by the way
those would be covered here under the
organizational context and should also
be included in your policies so now you
see how you can bring all of these
pieces together as you can see there's a
lot that goes into building a cyber
security program and getting it all
right the good news is the National
Institute of Standards created a cyber
security framework that you can use as
the basis for your own security program
I can't cover all the things to go into
that but I've tried to hit some of the
highlights here the good news again if
you use this then you'll know if you've
checked all the boxes and if you haven't
well the bad guys are going to let you
know and you're really not going to like
the way they tell you thanks for
watching if you found this video
interesting and would like to learn more
about cyber security please remember to
hit like And subscribe to this
channel